8 ms·
Cryptomator – Encrypt files on your cloud storage
- lostmsu 4y agoWhat library/driver is used to provide a virtual disk?
- tbrownaw 4y agoAnother comment had a link to their GitHub, which after a bit of looking mentions fuse : https://github.com/cryptomator/cryptomator/blob/develop/src/main/java/org/cryptomator/common/vaults/FuseVolume.java https://github.com/cryptomator/cryptomator/blob/develop/src/...
- geenat 4y agoSingle binary alternative, open source: https://github.com/FiloSottile/age https://github.com/FiloSottile/age From former head of Go security team at Google.
- aborsy 4y agoWhat’s the connection of this with the post? This is a utility to encrypt a file from command line. It’s like saying ZIP is an alternative, because it has encryption.
- upofadown 4y agoCryptomator provides entire encrypted remote drives. Age is a simple command line utility that is normally used to encrypt single files. Different sorts of things. Age in asymmetrical mode would be particularly bad for remote storage as it doesn't authenticate the file in this mode. The people running the server would be able to overwrite the files with whatever they wanted if they could get access to or figure out the public key used.
- dinosaurdynasty 4y agoAge also (iirc) doesn't provide authenticated encryption which is... a really weird decision to make and makes it unsuitable for anything in which you don't have authentication by another mechanism.
- upofadown 4y agoIt is authenticated in symmetrical mode based on knowledge of the shared password. But still not something that should be recommended to anyone who might not know the issues.
- dinosaurdynasty 4y agoYeah, it's unauthenticated in asymmetric mode https://github.com/FiloSottile/age/issues/59 https://github.com/FiloSottile/age/issues/59
- beebmam 4y agoThis is incorrect, they use https://en.wikipedia.org/wiki/ChaCha20-Poly1305 https://en.wikipedia.org/wiki/ChaCha20-Poly1305
- woodruffw 4y ago> Cryptomator's technology meets the latest standards and encrypts both files and filenames with AES and 256 bit key length. I know you're advertising to slightly less technical users, but please provide some documentation explaining your choices! AES alone doesn't say anything about the mode of operation, which makes or breaks the scheme. From a little sleuthing, it seems likely that they're using GCM-SIV[1], which is a good choice. [1]: https://github.com/cryptomator/siv-mode https://github.com/cryptomator/siv-mode
- brobinson 4y agohttps://docs.cryptomator.org/en/latest/security/architecture/ https://docs.cryptomator.org/en/latest/security/architecture... says AES in CTR mode unless I'm missing something.
- woodruffw 4y agoYeah, looks like you're right. SIV is only used to encrypt the "directory hierarchy," whatever that means in this context (why use two different modes?).
- sntran 4y agoAlternatively, rclone also lets you encrypt your data to any cloud providers they support. Great tool!
- POPOSYS 4y agoOK, but please compare https://rclone.org/crypt/ https://rclone.org/crypt/ vs https://nuetzlich.net/gocryptfs/quickstart/ https://nuetzlich.net/gocryptfs/quickstart/
- deleted 4y ago[deleted]
- ericpauley 4y agoJust because rclone is more completely documented doesn't mean it's harder to use. rclone has a wizard that quickly guides you through the steps, has secure defaults (e.g., generates secure password), and readily expands to other remote types once you've done one.
- durakot 4y agoLongtime happy Cryptomator user here. Use rclone, veracrypt, etc for stuff, but Cryptomator the perfect balance between security, ease of use, and reliability.
- anotherQuarter 4y agoI’ve been using Cryptomator for a few months now. Very happy with it. Closest to “main stream” file encryption tool that I’ve used. Confident anyone in my family could use it without much instruction.
- netheril96 4y agoIf it is not against the rules, I want to promote my project (https://github.com/netheril96/securefs https://github.com/netheril96/securefs) here. It is essentially the same functionality, but with authenticated encryption, better password hashing and optionally file size obfuscation (but no fancy UI).
- POPOSYS 4y agoHow does it compare to gocryptfs?
- netheril96 4y agoThe design of both are very similar. There are only minor feature differences. The following list is not exhaustive: `securefs` has but `gocryptfs` hasn't: * Native Windows support. * Extended attribute on Mac. * Random padding. `gocryptfs` has but `securefs` hasn't: * Reverse mount (mount a plain dir as an encrypted dir).
- POPOSYS 4y agoThanks for your quick reply - interesting, will take a look! BTW the reverse mount turns out to be a very useful feature that solves many problems with large file systems!
- akvadrako 4y agoSeems like it has no Android support.
- netheril96 4y agoAre there any FUSE file systems on Android? Not a rhetorical question.
- akvadrako 4y agoBut how is it a relevant question? Cryptomator and gocryptfs have Android support.
- POPOSYS 4y agoI recommend gocryptfs - very good performance, easy to automate, one binary, cross plattform, no fiddling with fuse libraries. It works like expected. Cryptomator is a strange example of how GUI-centric developers seem to be unaware of how important it is to make software usable on the command line. Also it is a good example of how using Java produces unexpected limitations and complications. I lost two days fiddling around with several simple use cases without good results - what an experience switching to gocryptfs and getting everything I need up in a few minutes because it just falls out naturally. It is an interesting lesson about software usability to compare cryptomator vs gocryptfs.
- aborsy 4y agoIf you don’t need to access via phones, gocryptfs is a good option. It might be possible via terminal to mount in Android, but I am not sure about iOS. Cryptomator does a lot more on user friendliness, looking at their community page.
- _emacsomancer_ 4y agoCf. https://github.com/hardcore-sushi/DroidFS https://github.com/hardcore-sushi/DroidFS on Android.
- akvadrako 4y agoI just tried this and it's much better than the Android app for Cryptomator, especially for browsing images.
- _emacsomancer_ 4y agoThe DroidFS dev is responsive as well.
- RcouF1uZ4gsC 4y agoFrom the gocryptfs homepage > Linux is fully supported. Beta-quality MacOS support is available, which means things usually work fine, but you may hit the odd issue (please file a ticket if you do!). > Third-party implementations exist for for > Windows: cppcryptfs > Android: DroidFS So gocryptfs has only beta support of Mac and no first party support for Windows/Android, and no support of iOS. On the other hand, Cryptomator has first party support for all these platforms. Based on the above, I don’t think that gocryptfs is really in the same space as Cryptomator which provides easy to use encrypted folders across all the major platforms that most people use.
- ctur 4y agoNot to go full neckbeard on this one, but in addition to FUSE-based options, there is at least one approach that achieves as good (or better) results using more trusted and common primitives in Linux: Just use cryptsetup on loopback mounted LUKS-structured files, and put the encrypted file in Dropbox or wherever. No filesystem-level weirdness, no random software with unknown/untested pedigree. Add a cronjob that unmounts the filesystem every N minutes and you have a pretty decent sometimes-on place to store just about anything. Double bonus, put a git repository and checkout in the filesystem and you get history of whatever you're stashing in there.
- POPOSYS 4y agoIf understanding your instructions correctly this will trigger upload of the whole encrypted file with every change on the mounted LUKS device. Some rsync-like binary diff could work with mounted big files syncing chunks across networks, but I am not sure if that works well when more than one mount of the remote file exists. Not sure if dropbox is a good tool for that. Please update, if I am wrong - I am interested in mounting encrypted remote files from more than one devices!
- aborsy 4y agoThis is not a good thing to do for two reasons. Disk encryption is with XTS mode, also not authenticated. If the remote is not trusted, a number of attacks are possible. Small changes in the LUKS container can trigger uploading the entire container. It seems, since Dropbox syncs deltas, it can get away with that by uploading changed blocks. That’s not the case with most cloud providers. That was actually the motivation for per file encryption for cloud storage.
- jeroenhd 4y agoMounted filesystems are easy to corrupt and not necessarily protected against server side attacks. Also, not every sync provider implements good block level sync, so you may be wasting a lot of bandwidth this way. I'd much rather go for classics like eCryptFs and EncFs. EncFs especially seems like a good match here, with its cross platform support. Gocryptfs also exists as a replacement, but portability doesn't seem to be as good. Either way, they have the same advantage (mounting a file system transparently with access to file based sync) without the disadvantage of needing to download the entire LUKS container. Optimizing for cloud sync is quite difficult. If we could trust something like AES ECB (we can't, don't use it) we could efficiently synchronise only changes to files like we can with unencrypted files, but alas. Partial modification with the same key and the same IV often go against the assumptions made by encryption modes and can easily introduce vulnerabilities. You probably also need to at least re-encrypt the rest of the file if you change just a single bit in the middle.
- nokaraoke 4y agoThe thing that makes this really good vs. the geek options is that this works on my mobile device as well… lovely app. Used for a few weeks. Excellent!
- woojoo666 4y agoSaw a similar tool called Kopia [1] posted on HN last year. Anybody have experience with it? [1]: https://news.ycombinator.com/item?id=27471945 https://news.ycombinator.com/item?id=27471945
- nexle 4y agoKopia is more for backup (snapshot with deduplication) instead of encrypt files on-the-fly for cloud storage. Very different use case.
- t0bia_s 4y agoProblem with cloud encryption is, when you need share files. For example I use OneDrive for send photographs/videos for my clients. But with encryption, I cannot send them anything. Well... 99% clients wont install thirdparty software to decrypt shared files.
- bradam 4y agoIf you're willing to use SaaS services (as you're mentioned OneDrive already), there are proper E2EE providers where you can work together and share files. Although I am not sure real time collaboration (such as Google Docs or Office online) is feasible with end-to-end encryption yet.
- t0bia_s 4y agoOneDrive is cheapest 1TB cloud storage I can get. I don't care about realtime colaboration, ony sharing files here and there, but having them encrypted on cloud.
- dellIsBetter 4y agoB2 is
- krnlpnc 4y agoBX11 is
- osmano807 4y agoAre you sure? I'm scared for traffic costs on data that sometimes I would need rapid access. B2 1TB/storage/month ~ $5 250GiB/traffic/month ~$2,5 On OneDrive 1TB/storage/month ~ $7 (home user, there's cheaper enterprise plans) 250GiB/traffic/month $0
- t0bia_s 4y ago1TB OneDrive in familly plan is 2 USD/month + office 365.
- fire 4y agois there much of a reason to use this over something like rclone with a crypt backend configured?
- thefz 4y agoIf only it worked on Linux, I get a SIGSEGV on two different distros for 1.6.10. Back to VeraCrypt, I guess.
- Caboose8685 4y agoThat's odd, I've been using cryptomator on arch for like 2 years now with no issue.
- OOvsuOO 4y agoHello, quick question here. If it works with dropbox will it work with google drive?
- gnuj3 4y agoIt works with everything, it’s just a folder on location of your choice.